CVE-2003-1582

Published: Feb 5, 2010Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Affected (1)

Products: Microsoft: Internet Information Server

1 product

Internet Information Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft Internet Information Server	Version 6.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

http://www.securityfocus.com/archive/1/313867

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/313867

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.